DigitalQuiver Tools

JWT Decoder

Decode a JSON Web Token's header and payload instantly.

This doesn't look like a valid JWT. It should have three parts separated by dots.

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe token made of three Base64URL-encoded parts separated by dots: a header, a payload and a signature. It is widely used for authentication and passing claims between a client and a server — for example, to say who a user is and when their session expires.

How to use it

  1. Paste a JWT into the box above.
  2. The header and payload are decoded and pretty-printed as JSON automatically.
  3. If the payload contains an exp (expiry) claim, this tool shows the corresponding human-readable date and whether the token has already expired.

This tool only decodes a token — it reads the Base64URL-encoded header and payload, which is not encryption and requires no secret key to reverse. It does not verify the signature, so it cannot tell you whether the token is authentic or was issued by a trusted server; verifying a signature requires the issuer's secret key or public key, which this browser-only tool never has access to. Because everything happens locally in JavaScript, pasting a token here does not send it to any server, which makes it safe to inspect tokens from your own development or staging environment.

More Security & Hash

Bcrypt Hash GeneratorHash text with bcrypt, and verify text against an existing hash. SHA-256 Hash GeneratorGenerate a SHA-256 hash of any text instantly. MD5 Hash GeneratorGenerate an MD5 checksum of any text instantly. HMAC GeneratorGenerate an HMAC signature from a message and secret key.